ldgr-homepage[.]wixstudio[.]com

The domain ldgr-homepage.wixstudio.com has been identified as a high-risk threat due to its involvement in brand impersonation, specifically targeting the cryptocurrency hardware wallet brand Ledger. This domain is designed to deceive users into believing they are interacting with official Ledger services, potentially leading to the compromise of sensitive information and financial assets.

Analysis indicates that the domain has been flagged by 14 out of 95 security vendors on VirusTotal, suggesting a moderate level of detection within the security community. The domain is registered through GoDaddy.com, LLC, and resolves to the IP address 34.144.206.118. Infrastructure analysis reveals the use of Wix, React, and Google Cloud services, including Google Cloud CDN and HTTP/3, which can enhance the site's performance and user experience but also make it more challenging to detect and block. The domain's SSL certificate is issued by Let's Encrypt, which is a common practice among both legitimate and malicious sites. The domain appears on three security blocklists: PhishDestroy, PhishingArmy, and OISD, and its status in the Google Safe Browsing database is currently marked as unsafe.

The domain is currently offline, indicating that it has been taken down by either the registrar or security organizations. Despite this, the risk remains as the domain could potentially be reactivated. Users are advised to remain vigilant and avoid clicking on any links or entering sensitive information on any page that appears similar to the Ledger brand. Security teams are encouraged to monitor for any reactivation of the domain and to implement additional defensive measures, such as DNS blacklisting and user education, to prevent further incidents.